Changed email address but my OVO Forum Messages are still sent to old address

The only way that could work at all would be via Single Sign-On and/or the inSided API.

OVO has already stated somewhere previously that they weren’t ready to do that for the Forum yet.

Just compare the cookies stored by this site (a) when you’re not signed in to the energy account, and (b) when you are. I’ve commented on this cross-pollination of cookies before. GS can tell whether you’re signed in or not, and even what your OVO account number is. 

While viewing this page, and while you’re signed in to your OVO energy account, paste this into your browser address bar:
  

javascript:function getCookie(name) {var value = '; ' + document.cookie;var parts = value.split('; ' + name + '=');if (parts.length == 2) return parts.pop().split(';').shift();}alert("You are signed in to OVO account no. " + getCookie('selectedAccountId'));

The browser might refuse to run script like this, e.g. by removing the javascript: prefix. I just put it back and tried again:
  

That would be massively insecure. I don’t think Gainsight could even do it that way because of web restrictions. Your code is also broken - no parts of OVO infrastructure serve your account number as a plaintext cookie.

There’s no way the Forum could have scraped your account number like that. Only the site that sets the cookie, can read that cookie back has been a strict rule since day 1.

Doesn’t my screenshot illustrate that the forum can indeed retrieve my account number? 
  

But that’s the point I’m making:

1. As soon as I sign in, this session cookie is set on the ovoenergy.com domain:
     

   

    

2. My code can’t be broken if it can retrieve this cookie. It should be trivial for Gainsight to check that one of the ovoenergy.com cookies set on sign-in exists before allowing a forum account username (email address) to be changed by the user. 
   
    

[Apologies to ​@PJW  for taking his thread so far off-course. If this is all too boring or abstruse, please just ignore our chit-chat.]  

That didn’t come from the Forum - it came from a third-party cookie so the Forum can’t see it.

Hey ​@Firedog 

I’ve had to remove the screenshots as they have got your account number and we don’t want that shared all across the Forum. 

Blastoise has left some good advice here already. I would add, it’s not possible for Gainsight to know anything about OVO accounts unless it’s been provided on the Forum, the Forum platform is in no way linked to any other OVO system to gain that data.

I wonder if it’s coming from the forum profile information when you signed up. There’s a similar private box to the email one Bradley added, where you can provide you account number, so I would assume it’s come from there? If you click into ‘My Profile’, you should be able to see if you’ve got it in there. You can also edit your profile there if you wish to remove it. 

It is a private function so only yourself, and us moderators can see that. 

So it’s all right for a third party (who?) to see my OVO energy account no., but it’s not all right for the forum platform to check whether a particular cookie exists at the forum site? Isn’t that a bit odd?

.ovoenergy.com is hardly a ‘third party’. It’s the parent domain of both forum.ovoenergy.com and account.ovoenergy.com, which is why the browser allows them to share cookies, the point I’ve been trying to make. It’s possible that not everyone will see the selectedAccountID cookie, but the account no. is available nonetheless as one of the elements in the main MixPanel cookie. Please have a look.

I’m not sure what is so insecure about subdomains sharing cookies (and I don’t understand why I’m not allowed to show my account no. here). I clearly have a lot to learn about forum security.